ci: gate release on atoms verification

.github/workflows/publish.js.yml

@@ -22,6 +22,15 @@ jobs:
         node-version: lts/*
     - run: npm install --no-package-lock
       name: Install dev dependencies
+    - name: Type-check atoms/src
+      run: npm run typecheck:atoms
+    - name: Rebuild atoms from atoms/src and check for drift
+      run: |
+        npm run build:atoms
+        if ! git diff --exit-code -- atoms; then
+          echo "::error::'atoms/' on master does not match what 'npm run build:atoms' produces from 'atoms/src/'. This should have been caught by the 'Verify Atoms' check on the PR — aborting release."
+          exit 1
+        fi
     - run: npm run build
       name: Run build
     - run: npm run test

.github/workflows/verify-atoms.yml

@@ -1,12 +1,6 @@
 name: Verify Atoms
 
 on:
-  push:
-    paths:
-    - 'atoms/**'
-    - 'scripts/build-atoms.mjs'
-    - 'tsconfig.atoms.json'
-    - 'package.json'
   pull_request:
     paths:
     - 'atoms/**'